230f0082865e50035b6852690a86d1c58cdf8f04849bcd108b5f47bfd1fd4f0b

Analysis

max time kernel
85s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2023, 08:42

Target

bc_vbdll.dll
Size

597KB
MD5

2942776de4fbfe3aa7809648dec131c9
SHA1

7bba1ceaf1edde2f0425205ac36b65223f5a3ce5
SHA256

7e123a61a4a9e2e73933ec8e06a4b1bb4acdd95f454640a11c58aac417b2ff5d
SHA512

bd6713c889ea712853ad1ee329ef5c1528e6d6b7bd342a920d62609485f4df59b7b3493637a5c925d2ebd0026d4362435129ab8e2b3c7c7cb3209300edfca7d7
SSDEEP

12288:yp1LN6OXp8+SJxYSXoPwttT/84/SkWEH4KulkNsR0IZSYmvx3gQJzHl8Bqh:06O2uSXoPwttzn6qYGNq0qXmvxBFAo

Score

7^/10

upx

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral14/memory/4440-0-0x0000000010000000-0x0000000010222000-memory.dmp	upx
behavioral14/memory/4440-1-0x0000000066E00000-0x0000000066EF0000-memory.dmp	upx
behavioral14/memory/4440-2-0x0000000066E00000-0x0000000066EF0000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3380 wrote to memory of 4440	3380	rundll32.exe	84
PID 3380 wrote to memory of 4440	3380	rundll32.exe	84
PID 3380 wrote to memory of 4440	3380	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bc_vbdll.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3380
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bc_vbdll.dll,#1
  2⤵
  PID:4440

memory/4440-0-0x0000000010000000-0x0000000010222000-memory.dmp

Filesize
2.1MB

Download
memory/4440-1-0x0000000066E00000-0x0000000066EF0000-memory.dmp

Filesize
960KB

Download
memory/4440-2-0x0000000066E00000-0x0000000066EF0000-memory.dmp

Filesize
960KB

Download